Skip to content

WPA/WPA2 handshake & PMKID crack

1. Context & stakes

Capture the 4-way handshake or PMKID and crack the PSK offline.

WPA2-PSK derives every session key from one passphrase, so capturing the 4-way handshake, or even a single PMKID from the AP, gives an attacker everything needed to brute-force that passphrase offline at full GPU speed, with the AP never involved again. Weak or reused PSKs fall in seconds. This is why WPA3-SAE and long random passphrases matter for any shared-key network.

2. Theory

WPA2-PSK derives session keys from a 4-way handshake (ANonce, SNonce, MICs), all keyed by PMK = PBKDF2(passphrase, SSID). The handshake travels in the clear, so capturing it - or the PMKID the AP places in message 1 - lets an attacker test passphrases offline: recompute the PMK per candidate and check the MIC. WPA3-SAE replaces this with a PAKE that resists offline guessing.

3. Attack (PoC)

netlab-wpa-crack attack --i-own-this-network --iface veth-host
  1. Capture handshake (deauth-assisted) or PMKID
  2. Offline dictionary / GPU crack

4. Detection

netlab-wpa-crack detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Long random passphrase or WPA3-SAE
  • Enterprise auth (no shared PSK)

6. Exercise

This module is not replayable in the netns/veth lab - it needs real radio hardware. Build a wireless bench you fully own:

  • A Wi-Fi adapter that supports monitor mode + injection (e.g. Atheros AR9271, MediaTek MT7612U); enable it with sudo airmon-ng start wlan0.
  • A dedicated victim AP you own (a spare router, or a hostapd soft-AP) plus a throwaway client - never a third party's network.
  • Run the bench in a shielded / low-traffic area; attacking any network you do not own is illegal.

7. Further reading